EUVD-2026-54233
GHSA-j2vp-f2pv-5rj4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
AC:H reflects the required non-default template configuration; PR:N confirmed by advisory; A:H for irreversible content/asset destruction; C:N as no disclosure impact described.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
3DescriptionCVE.org
Impact
Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.
Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.
Patches
This has been fixed in 5.74.1 and 6.24.0.
AnalysisAI
Unsafe method invocation via Antlers template resolution in Statamic CMS enables unauthenticated remote attackers to destroy content and stored assets on affected installations. Sites running statamic/cms below 5.74.1 or in the 6.x line below 6.24.0 are vulnerable when their templates incorporate user-supplied input into Antlers template resolution - a deployment pattern present on developer-facing or dynamic sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Statamic site to have one or more Antlers templates that incorporate untrusted user-supplied input - such as HTTP request parameters, form fields, or URL segments - directly into Antlers template variable or method resolution without sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H scores 6.5, reflecting a genuine tension between the network-reachable, unauthenticated attack surface (AV:N/PR:N) and the high-complexity precondition (AC:H) imposed by requiring templates that pass untrusted input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade statamic/cms to version 5.74.1 (for v5 users) or 6.24.0 (for v6 users) via Composer: run 'composer update statamic/cms' and confirm the installed version meets the fixed threshold. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today